Malicious code in twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e60e623d29b1989a7cbce00ae577fdcbe27d82d33a7f2f8c03ffe52b317f4f8 On require of the package, index.js loads compat.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

MAL-2026-11549 Malicious code in tinkoff-terminal-kit-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d67091b6d7ee752850793817e0bf77d92b3bc16bff12d5348e81c1cb39cf6423 On require of the package, index.js loads adapter.js, which selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of thr...

Malicious code in tinkoff-terminal-kit-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d67091b6d7ee752850793817e0bf77d92b3bc16bff12d5348e81c1cb39cf6423 On require of the package, index.js loads adapter.js, which selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of thr...

MAL-2026-11522 Malicious code in beaver-ui-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c303fcf069e3feb6dfa3d2b8ba7b7b2251c89d796bcf9fcd5d05e44849c64a0d Package advertises itself as a React UI toolkit but on require, helpers.js runs init at module load which selects a platform-specific URL, fetches a...

Malicious code in beaver-ui-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c303fcf069e3feb6dfa3d2b8ba7b7b2251c89d796bcf9fcd5d05e44849c64a0d Package advertises itself as a React UI toolkit but on require, helpers.js runs init at module load which selects a platform-specific URL, fetches a...

CVE-2026-50738

A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled during normal worker lifecycle events. The condition is reachable during normal replication operation, including by a...

CVE-2026-66752 tiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding Handling

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditionally apply chunk-decoding and discard...

CVE-2026-16407

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Service Workers component...

CVE-2026-16382

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Service Workers component...

CVE-2026-16365

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Workers component...

CVE-2026-64424 netpoll: fix a use-after-free on shutdown path

In the Linux kernel, the following vulnerability has been resolved: netpoll: fix a use-after-free on shutdown path There is a use-after-free error on netpoll, which is clearly detected by KASAN. BUG: KASAN: slab-use-after-free in rawspinlockirqsave+0x3b/0x80 Read of size 1 at addr ... by task...

Linux Distros Unpatched Vulnerability : CVE-2026-16382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CVE-2026-16382 Note that Nessus relies...

Linux Distros Unpatched Vulnerability : CVE-2026-16407

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CVE-2026-16407 Note that Nessus relies...

Linux Distros Unpatched Vulnerability : CVE-2026-16365

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. CVE-2026-16365 Note that Nessus relies on t...

Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers

A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet. XBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat i...

SUSE CVE-2026-16365

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15...

SUSE CVE-2026-16382

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

SUSE CVE-2026-16407

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

CVE-2026-16407

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

CVE-2026-16382

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...